CN102469103A - Trojan event prediction method based on BP (Back Propagation) neural network - Google Patents
Trojan event prediction method based on BP (Back Propagation) neural network Download PDFInfo
- Publication number
- CN102469103A CN102469103A CN2011101832139A CN201110183213A CN102469103A CN 102469103 A CN102469103 A CN 102469103A CN 2011101832139 A CN2011101832139 A CN 2011101832139A CN 201110183213 A CN201110183213 A CN 201110183213A CN 102469103 A CN102469103 A CN 102469103A
- Authority
- CN
- China
- Prior art keywords
- wooden horse
- data
- neural net
- error
- network
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Landscapes
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The invention provides a Trojan event prediction method, comprising the following steps of: training a BP (Back Propagation) neural network by using statistical data of the quantity of occurrence of Trojan events in network flow data within a certain time slot; and predicting the quantity of the occurrence of the Trojan events in the network in future by using the trained BP neural network. According to the invention, a prediction function is approached well without knowing the quantity of the occurrence of the Trojan events in the large-scale network, so as to achieve a good prediction result. Furthermore, accurate prediction can be directly used by using new flow data, but the network does not need to be readjusted with the change of input data.
Description
Technical field
The invention belongs to network security, relate in particular to wooden horse event prediction method.
Background technology
Current, along with the high speed development of information technology, the network size of the Internet, network information amount and network application etc. are all in continuous growth.The Internet is in the each side field that relates to people life, like politics, and commerce, finance, culture and education, more and more important effect is being brought into play in communication etc.But the Internet also is faced with increasing network safety event bringing people simultaneously greatly easily.Since the open interconnectivity of the Internet, the defective of procotol self, and many-sided reasons such as the leak of operating system and vulnerability of application program have caused the generation of diverse network security incident.Network attack means as common have: wooden horse is attacked, and worm-type virus is attacked, buffer overflow attack, Denial of Service attack, distributed denial of service attack etc.
The network safety event Predicting Technique is fully to collect the present flow rate data status, obtaining a special kind of skill of predicting on the historical security incident of the network basis that a situation arises.Because wooden horse is attacked and in the security incident under the large scale network, is accounted for significant proportion; Through wooden horse incident generation quantity in the moment in the future network is predicted; Can make things convenient for the network management personnel that the cardinal principle situation of whole network is had a preliminary judgement on the one hand, and formulate the network security policy that conforms to it, like access control policy according to situation about judging; The information encryption strategy; Can shift to an earlier date the network disaster that anticipation will take place on the other hand or attack, and in time take counter-measure with attacking before taking place, eliminate problem in bud in disaster.
Existing wooden horse event prediction method has following several kinds:
Linear regression method: the autoregressive moving-average model model with classics is representative, is characterized in that model is simple, realize easily, but to having the data prediction DeGrain of noise.And the solution effect for the complex nonlinear problem is bad.
The method of rule-based discovery: like the sequential rule discovery, frequent plot excavation etc., the characteristics of these class methods are the information such as confidence level that prediction data can be provided, but are prone to the loss data message in the regular conversion process.
Based on Fourier transform or method of wavelet: these class methods are because to decompose the tranquilization method unstable, and it is bigger therefore influenced by concrete data set, extensive poor-performing.
Summary of the invention
Therefore, the objective of the invention is to overcome the defective of above-mentioned prior art, provide a kind of Forecasting Methodology to satisfy the prediction accuracy of network security to wooden horse incident generation quantity, the requirement of aspects such as time complexity based on the BP neural net.
The objective of the invention is to realize through following technical scheme:
On the one hand, the invention provides a kind of BP neural metwork training method that is used for the wooden horse event prediction, comprising:
Step 1) is a training sample with the statistics of the quantity that in the certain hour section network traffics data wooden horse incident taken place;
Step 2) with before k-1 statistics to the quantity of certain type of wooden horse incident generation be input, be output with the k time statistics to such wooden horse incident generation quantity, train said BP neural net, wherein k is the natural number greater than 1.
According to the BP neural metwork training method of the embodiment of the invention, wherein, step 2) may further comprise the steps:
Step a) is provided with a sliding window, and its size is m, and said sliding window covers m data in n the statistics of the quantity that certain type of wooden horse incident in the said time period takes place;
Step b) is got the interior data of sliding window as input, and next-door neighbour's data are as desired output after the sliding window;
The input layer number of step c) BP neural net is m, and output layer node number is decided to be 1;
Step d) step-up error precision, neuron weights are got any number between 0 to 1 at random;
Step e) is calculated the output result;
If the error between step f) output result and the desired output is then carried out backpropagation greater than said error precision, adjustment neuron weights are till the error between output result and the desired output is less than said error precision;
The step g) sliding window slides backward a data values, repeated execution of steps b) to step g) till handling all n statistics.
According to the BP neural metwork training method of the embodiment of the invention, wherein, the said time period is 1 hour.
According to the BP neural metwork training method of the embodiment of the invention, wherein, said error precision is 0.05, and the number of plies of said BP neural net is three layers, and said BP neural net hidden layer node number adopts trial and error procedure to confirm.
According to the BP neural metwork training method of the embodiment of the invention, wherein, further comprising the steps of before step 1):
According to the data on flows training classification BP neural net that comprises the wooden horse incident;
The classification BP neural net that utilization trains is carried out statistic of classification to each wooden horse incident in the said time period network traffics data, obtains the quantity of all kinds of wooden horse incidents in the interior data on flows of this time period.
According to the BP neural metwork training method of the embodiment of the invention, wherein, further comprising the steps of before the step of training classification BP neural net:
Remove outlier, said outlier is meant that in a flow sequence away from average extreme big value of sequence and extremely little value, said flow sequence refers to wooden horse incident generation quantity series;
Supply damaged value, said damaged value is meant losing of flow information.
According to the BP neural metwork training method of the embodiment of the invention, wherein, training classification BP network may further comprise the steps:
All kinds of wooden horse incidents with known are input to calling of one group of API;
For every kind of wooden horse is set a Decision boundaries;
Each input node identification calls a kind of API's, and output layer is provided with a node;
Step-up error precision, neuron weights are got any number between 0 to 1 at random;
If the wooden horse incident has been called this API, then this node is input as 1, if do not call this API, then is input as 0;
Calculate the output result;
If the error between the output result Decision boundaries corresponding with such wooden horse incident is greater than said error precision; Then carry out backpropagation; Adjustment neuron weights are till the error between the output result Decision boundaries corresponding with such wooden horse incident is no more than error precision.
BP neural metwork training method according to the embodiment of the invention; Wherein, said Decision boundaries is set to the numeral between 0～1, and said error precision is 0.05; The number of plies of said BP neural net is three layers, and said BP neural net hidden layer node number adopts trial and error procedure to confirm.
Another aspect the invention provides a kind of Forecasting Methodology of wooden horse incident, comprising:
The neural net that utilization trains according to the training method of the foregoing description; Statistics with certain type of wooden horse generation quantity in the historical data on flows in the network is the input of said neural net, and said neural net is output as the quantity of such wooden horse incident that network will take place.
Existing Forecasting Methodology all need be set up forecast model; But be difficult to obtain the formula that embodies of anticipation function again; And the present invention adopts the BP neural net wooden horse incident is classified and to predict; In assorting process, judge the kind of wooden horse, in forecasting process,, reach gratifying prediction effect through more accurate function approximation through utilizing data on flows that wooden horse incident generation quantity in the network is predicted through the sequence analysis of wooden horse being called API.
Description of drawings
Followingly the embodiment of the invention is described further with reference to accompanying drawing, wherein:
Fig. 1 is according to an embodiment of the invention based on the flow chart of the wooden horse event prediction method of BP neural net.
Embodiment
In order to make the object of the invention, technical scheme and advantage are clearer, pass through specific embodiment to further explain of the present invention below in conjunction with accompanying drawing.Should be appreciated that specific embodiment described herein only in order to explanation the present invention, and be not used in qualification the present invention.
In order to understand the present invention better, earlier the basic principle of BP neural net is simply introduced.The BP neural net has comprised one deck input layer, one deck output layer and one deck hidden layer at least.Its basic principle is through calculating the error between output layer and the desired output, begin oppositely to adjust each neuronic weights and bias from output layer then, finally making the output of network and the error between the desired output satisfy predefined requirement.Specifically, the training of BP neural net is divided into following two stages: the propagated forward stage: input vector is introduced by input layer, conducts to output layer with feed-forward mode via hidden layer, and calculates the network output valve, and at this moment, the weights of network are all fixed.Back-propagation phase: the weights of network are then revised according to the error correction rule; So that the output valve of network trends towards desired output; Specifically promptly be to deduct the network output valve with desired output to obtain error signal, then this error signal backpropagation returned in the network.
Fig. 1 is the flow chart based on an embodiment of the wooden horse event prediction method of BP neural net.As shown in Figure 1, mainly by the data preliminary treatment, wooden horse event classification and wooden horse event prediction are formed based on the wooden horse event prediction method of BP neural net.In order to make wooden horse event prediction method satisfy user's demand, at first carry out the data preliminary treatment, to the outlier in the data, damaged value and noise are handled, and remaining data can be reached do experimental requirements in an embodiment of the present invention.Adopt the BP neural net earlier the wooden horse in the network to be classified then,, utilize the BP neural net that wooden horse incident generation quantity in the network is predicted at last again according to classification results.
(1) preliminary treatment of data
For the data on flows that collects, because the inaccuracy of collecting device, Network Transmission is unreliable, or some artificial errors that occur in the gatherer process, can cause data outlier to occur, and therefore data such as damaged value will carry out preliminary treatment to data.Flow sequence cited below all refers to wooden horse incident generation quantity series if no special instructions.
Outlier is meant in a flow sequence, away from average extreme big value of sequence and extremely little value.For outlier, use
The mean value of expression sequence, the formula of embodying does
N representes the number of data in the sequence, X
iI data in the expression sequence.S
2The sample variance of expression sequence, it embodies formula and does
If have
Set up, then think X
tBe an outlier, wherein subscript t representes t data in the sequence.Wherein k is a constant, in the prior art, gets 3～9 integer, and k gets 6 here.If X
tBe an outlier, then use
Replace.
Damaged value is meant losing of flow information, and this is that unsteadiness owing to network causes.If occurred damaged value in the flow sequence, then will be according to its movement locus or variation tendency, the utilization certain method is estimated to infer and supply to damaged value.The prior art of supplying about damaged value has a lot of methods, can adopt exponential smoothing here, and the average of data on flows is carried out smoothly it before promptly utilizing.If d days t data on flows x constantly
D, tLose, then the value of supplying by first three day synchronization the average of data on flows confirm:
Use the method can supply damaged data preferably, and the trend and the cyclophysis of the dependable flow data of maximum possible, the prediction after making it can have higher precision under the incomplete situation of initial data.
Screen out outlier through the data of gathering are done preliminary treatment, supply damaged value, tackle various wooden horse incidents with that and classify.
(2) BP neural network classification
At first train a BP neural net with good classification performance.The basic thought of this classification BP neural net is the executable file through static analyzer, the API set that possibly call when obtaining program running.Here analyzing executable file is in order the calling sequence of API to be judged the classification of this wooden horse through wooden horse.The executable file here is meant the file that is infected by certain trojan horse.It promptly is through the API of system called completion to the infection of system and the propagation of self in essence that wooden horse is attacked.After the API set of calling when obtaining program running, classify, observe it and belong to any wooden horse attack this set.For different types of wooden horse, as the technological wooden horse that rebounds, being dynamically embedded into the formula wooden horse, the windows buffering area overflows embedded type wooden horse etc., and its calling sequence to API all is not quite similar.Therefore can utilize these known trojan horses that calling of API trained a BP neural net.Through utilizing the numeral between 0～1 that every kind of wooden horse is artificially set a Decision boundaries, then can confirm that wooden horse is the wooden horse of which kind of type according to this Decision boundaries.The Decision boundaries here is artificial the setting.As long as the output result is no more than 0.05 with the artificial Decision boundaries error of setting.
Because verified three layers BP neural net can be handled nonlinear problem arbitrarily on the mathematics, is decided to be three layers to the number of plies of BP neural net in an embodiment of the present invention.Definite method of BP neural net hidden layer node number commonly used is trial and error procedure now; So-called trial and error procedure; Promptly be the data volumes of system development personnel according to Processing with Neural Network; Roughly what hidden layer nodes estimation needs, and value and result of calculation successively in this interval are got the hidden layer node number of the minimum node number of error as final network at last then.For the input number of nodes of BP neural net, consider that wooden horse is corresponding to calling of API, if a lot of API are arranged, then consider some typical, representative API that this trojan horse calls.For this BP neural net, each input node identification calling to a kind of API.If called this API in the program, then this node is input as 1, if do not call this API, then is input as 0.Output layer only is provided with a node, utilizes the output of this node and the Decision boundaries of confirming before to compare, and can obtain the type of this wooden horse.
For example: provide API, NtOpenMutant, NtOpenProcess; NtOpenSection, RtlCustomCPToUnicodeN, RtlCreateUserStack; RtlDefaultNpAcl, to its from 1 to 6 numbering, the technological wooden horse call number that rebounds is 1 and 2 API successively; Be dynamically embedded into formula wooden horse call number and be 3 and 4 API, it is 5 and 6 API that the windows buffering area overflows embedded type wooden horse call number.Corresponding successively these 6 different API of 6 of the BP neural net input layers then.Give different weights, from 0.1 to 0.6 to these 6 nodes successively.Here be that significance level according to node increases gradually to giving of node weights.Weight can be adjusted in the training process of back gradually automatically, and the adjustment mode of this back then is to adjust according to the conventional method of BP neural net.Hidden layer node is several confirms that according to trial and error procedure be decided to be 3 here, the node weights of hidden layer is got any value between 0 to 1 at random.If certain wooden horse has called the corresponding API of this node, then this node be input as 1, otherwise be input as 0.What suppose will to judge now is the technological wooden horse of bounce-back, then because it calls is to be numbered 1 and 2 API, then node 1 and 2 be input as 1.Node weights is multiply by in input, is delivered to hidden layer again, the calculating of the transfer function of process hidden layer and output layer.The transfer function here promptly is the sigmoid function; Its expression formula promptly is to carry out according to the conventional method of BP neural net for
The whole calculations process, no longer sets forth here.This neural net obtains an output result at last, and in this example, last result of calculation is 0.28.For the technological wooden horse of bounce-back, setting Decision boundaries here is 0.3.According to the routine setting of BP network, error precision requires within 0.05 scope.Calculate the error between output result and the desired output, in this example, the output result promptly is 0.28; Desired output promptly is 0.3, and the error between them can think then that less than 0.05 this moment, this wooden horse was the technological wooden horse of bounce-back; Otherwise, oppositely adjust the adjustment weights; Recomputate the output result at last, accomplish classification the wooden horse incident.In like manner, also carry out like this being dynamically embedded into the judgement that formula wooden horse and windows buffering area overflow the embedded type wooden horse.
According to the data on flows that has had classification BP network is trained earlier, after it can correctly be judged, add up, calculate the quantity of every kind of wooden horse in the current network stream dividing good type wooden horse incident quantity.The BP neural net of prediction is predicted the wooden horse incident that will take place below utilizing at last.
(3) BP neural network prediction
Along with the continuous variation of data on flows, the wooden horse incident in the network also can change certainly thereupon.Because the data on flows in the network all has self-similarity; Be that data traffic afterwards of a certain moment can exist certain similitude with the data traffic before this moment; Therefore in an embodiment of the present invention, expressing this similitude with function expression, promptly is that the quantity of certain wooden horse incident in the network at a time and data on flows before satisfy such functional relation: y=f (x
1, x
2, L L, x
n), wherein y is a wooden horse incident quantity, x is the data on flows of adding up for n time before.For the nonlinear function of such complicacy,, can only approach with the method for non-parametric estmation owing to can't obtain its concrete expression formula.
A sliding window model is set here, and window size is n.The data on flows that is engraved in when a certain in the window has n, is illustrated in the data on flows of current time n statistics before.Along with the increase of time, sliding window is also constantly pushed ahead.Every propelling is once abandoned first data on flows x
1, one of all remaining data on flows subscript reach add nearest data on flows at last, and label is x
nSo can calculate the quantity of each wooden horse incident through the data on flows before and the classification situation of wooden horse incident are made statistics.
Then with before the data on flows of n statistics serve as the input of prediction BP neural net, as the desired output of predicting the BP neural net, train this neural net with the quantity of certain wooden horse incident.Considered that in training process data on flows more forward is more little to the influence of current wooden horse incident; Data on flows the closer to the current time node is big more to the influence of current wooden horse incident; Therefore through being set different biases, neuron characterizes this different influence; For the more little data on flows node of influence, bigger bias is set, this bias is provided with at random.This method is the common method of BP neural net.After node obtains result of calculation, utilize this result to deduct bias again, its influence that can more decay like this for the bigger data on flows node of influence, then is provided with less bias to keep its most influence.The neural net that training obtains after accomplishing can be as the approaching of anticipation function, and this anticipation function promptly is a non-linear expressions between wooden horse generation incident quantity and the wooden horse generation incident quantity before in the current time network.In prediction, the present flow rate data as input data x
n, the data on flows that n-1 time is gathered before adopting is respectively as input data x
1, x
2, x
N-1, the neural net of accomplishing training before utilizing calculates dateout, and this promptly is the quantity that next moment this kind wooden horse incident takes place.
For example, for the technological wooden horse of bounce-back, quantity taking place in the historical time section in network be respectively 101,102,103,104,91,92,93,94,100,110, a sliding window is set here, gets 5 data at every turn and predict.The input layer number of BP neural net is 5, and the hidden layer node number takes trial and error procedure to be decided to be 3, and output layer node number is decided to be 1.Error precision is set to 0.05, and the neuron weights are got any number between 0 to 1 at random.For data 101,102,103,104,91, desired output is 92, if the error between the output result and 92 is then carried out backpropagation greater than 0.05, adjustment neuron weights are till the output result meets the demands.After training was accomplished once, sliding window slided backward a numerical value, utilizes sequence 102,103, and 104,91,92 train, the precision that the error between last result and 93 is met the demands.Training like this can utilize data 92,93 at last successively, and 94,100,110 predict, neural net just can be approached anticipation function more accurately like this.
In sum, the present invention mainly solves wooden horse incident generation quantitative forecast problem in the network.Because the BP neural net can realize any complex nonlinear mapping function; And general Forecasting Methodology all need be set up forecast model; But be difficult to obtain the anticipation function of the formula of embodying again; The BP neural net just in time can be used for handling this type problem, reaches gratifying prediction effect through more accurate function approximation.
Compared to other wooden horse event prediction method, adopt the wooden horse Forecasting Methodology of BP neural net to have following several kinds of advantages:
Non-linear mapping capability: can learn and store a large amount of input-output mode map relations, and need not to understand in advance the math equation of describing this mapping relations.As long as can provide abundant sample mode that network is carried out learning training, just it can be accomplished by the Nonlinear Mapping of the n dimension input space to m dimension output region.Utilize this dot characteristics, the BP neural net can well be gone to approach this anticipation function, thereby obtain good predicting the outcome under the situation that need not know wooden horse incident generation quantitative forecast function in the large scale network.
Generalization ability: when the non-sample data do not met to network when training input, network also can be accomplished by the correct mapping of the input space to output region.As time goes on, the data on flows in the network is also constantly changing.Utilize this dot characteristics, the data on flows that the BP neural net can directly be utilized is newly made prediction accurately, and need be along with network is readjusted in the variation of input data.
Fault-tolerant ability: it is very little to the input and output rule influence of network to have bigger error even indivedual mistake in the input sample.Because this dot characteristics has improved the tolerance of BP neural net to misdata, reduced the error of prediction.
Though the present invention is described through preferred embodiment, yet the present invention is not limited to described embodiment here, also comprises various changes and the variation done without departing from the present invention.
Claims (9)
1. BP neural metwork training method that is used for the wooden horse event prediction comprises:
Step 1) is a training sample with the statistics of the quantity that in the certain hour section network traffics data wooden horse incident taken place;
Step 2) with before k-1 statistics to the quantity of certain type of wooden horse incident generation be input, be output with the k time statistics to such wooden horse incident generation quantity, train said BP neural net, wherein k is the natural number greater than 1.
2. according to the BP neural metwork training method of claim 1, wherein, step 2) may further comprise the steps:
Step a) is provided with a sliding window, and its size is m, and said sliding window covers m data in n the statistics of the quantity that certain type of wooden horse incident in the said time period takes place;
Step b) is got the interior data of sliding window as input, and next-door neighbour's data are as desired output after the sliding window;
The input layer number of step c) BP neural net is m, and output layer node number is decided to be 1;
Step d) step-up error precision, neuron weights are got any number between 0 to 1 at random;
Step e) is calculated the output result;
If the error between step f) output result and the desired output is then carried out backpropagation greater than said error precision, adjustment neuron weights are till the error between output result and the desired output is less than said error precision;
The step g) sliding window slides backward a data values, repeated execution of steps b) to step g) till handling all n statistics.
3. BP neural metwork training method according to claim 1 and 2, wherein, the said time period is 1 hour.
4. BP neural metwork training method according to claim 2, wherein, said error precision is 0.05, and the number of plies of said BP neural net is three layers, and said BP neural net hidden layer node number adopts trial and error procedure to confirm.
5. BP neural metwork training method according to claim 1, wherein, further comprising the steps of before step 1):
According to the data on flows training classification BP neural net that comprises the wooden horse incident;
The classification BP neural net that utilization trains is carried out statistic of classification to each wooden horse incident in the said time period network traffics data, obtains the quantity of all kinds of wooden horse incidents in the interior data on flows of this time period.
6. BP neural metwork training method according to claim 5, wherein, further comprising the steps of before the step of training classification BP neural net:
Remove outlier, said outlier is meant that in a flow sequence away from average extreme big value of sequence and extremely little value, said flow sequence refers to wooden horse incident generation quantity series;
Supply damaged value, said damaged value is meant losing of flow information.
7. according to claim 5 or 6 described BP neural metwork training methods, wherein, training classification BP network may further comprise the steps:
All kinds of wooden horse incidents with known are input to calling of one group of API;
For every kind of wooden horse is set a Decision boundaries;
Each input node identification calls a kind of API's, and output layer is provided with a node;
Step-up error precision, neuron weights are got any number between 0 to 1 at random;
If the wooden horse incident has been called this API, then this node is input as 1, if do not call this API, then is input as 0;
Calculate the output result;
If the error between the output result Decision boundaries corresponding with such wooden horse incident is greater than said error precision; Then carry out backpropagation; Adjustment neuron weights are till the error between the output result Decision boundaries corresponding with such wooden horse incident is no more than error precision.
8. BP neural metwork training method according to claim 7; Wherein, said Decision boundaries is set to the numeral between 0～1, and said error precision is 0.05; The number of plies of said BP neural net is three layers, and said BP neural net hidden layer node number adopts trial and error procedure to confirm.
9. the Forecasting Methodology of a wooden horse incident comprises:
The neural net that utilization trains according to one of aforesaid right requirement 1 to 8 described training method; Statistics with certain type of wooden horse generation quantity in the historical data on flows in the network is the input of said neural net, and said neural net is output as the quantity of such wooden horse incident that network will take place.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 201110183213 CN102469103B (en) | 2011-07-01 | 2011-07-01 | Trojan event prediction method based on BP (Back Propagation) neural network |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 201110183213 CN102469103B (en) | 2011-07-01 | 2011-07-01 | Trojan event prediction method based on BP (Back Propagation) neural network |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN102469103A true CN102469103A (en) | 2012-05-23 |
| CN102469103B CN102469103B (en) | 2013-03-06 |
Family
ID=46072274
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN 201110183213 Expired - Fee Related CN102469103B (en) | 2011-07-01 | 2011-07-01 | Trojan event prediction method based on BP (Back Propagation) neural network |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102469103B (en) |
Cited By (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103532957A (en) * | 2013-10-18 | 2014-01-22 | 电子科技大学 | Device and method for detecting trojan remote shell behavior |
| CN104573142A (en) * | 2013-10-10 | 2015-04-29 | 无锡市思库瑞科技信息有限公司 | Password attribute analysis method based on neural network |
| CN106408085A (en) * | 2016-08-31 | 2017-02-15 | 天津南大通用数据技术股份有限公司 | BP neural network classification method for solving nonlinear problem through single hidden layer |
| CN107247954A (en) * | 2017-06-16 | 2017-10-13 | 山东省计算中心（国家超级计算济南中心） | A kind of image outlier detection method based on deep neural network |
| CN109063777A (en) * | 2018-08-07 | 2018-12-21 | 北京邮电大学 | Net flow assorted method, apparatus and realization device |
| CN109740348A (en) * | 2019-01-29 | 2019-05-10 | 福州大学 | A kind of hardware Trojan horse localization method based on machine learning |
| CN109858246A (en) * | 2018-12-24 | 2019-06-07 | 福州大学 | A kind of classification method for control signal type hardware Trojan horse |
| CN110990835A (en) * | 2019-11-22 | 2020-04-10 | 南京邮电大学 | Neural network Trojan horse detection method based on sample judgment error |
| CN111324889A (en) * | 2020-03-04 | 2020-06-23 | 深信服科技股份有限公司 | Security event prediction method, device, equipment and computer readable storage medium |
| CN111865999A (en) * | 2020-07-24 | 2020-10-30 | 中国工商银行股份有限公司 | Access behavior recognition method and device, computing equipment and medium |
| CN113568068A (en) * | 2021-07-22 | 2021-10-29 | 河南大学 | Strong convection weather prediction method based on MPI parallel three-dimensional neural network |
| US11394742B2 (en) | 2020-08-17 | 2022-07-19 | International Business Machines Corporation | Detecting trojan neural networks |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1668015A (en) * | 2004-12-20 | 2005-09-14 | 华中科技大学 | Cooperative intrusion detection based large-scale network security defense system |
| CN101399672A (en) * | 2008-10-17 | 2009-04-01 | 章毅 | Intrusion detection method for fusion of multiple neutral networks |
-
2011
- 2011-07-01 CN CN 201110183213 patent/CN102469103B/en not_active Expired - Fee Related
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1668015A (en) * | 2004-12-20 | 2005-09-14 | 华中科技大学 | Cooperative intrusion detection based large-scale network security defense system |
| CN101399672A (en) * | 2008-10-17 | 2009-04-01 | 章毅 | Intrusion detection method for fusion of multiple neutral networks |
Cited By (18)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104573142A (en) * | 2013-10-10 | 2015-04-29 | 无锡市思库瑞科技信息有限公司 | Password attribute analysis method based on neural network |
| CN103532957A (en) * | 2013-10-18 | 2014-01-22 | 电子科技大学 | Device and method for detecting trojan remote shell behavior |
| CN103532957B (en) * | 2013-10-18 | 2017-09-15 | 电子科技大学 | A kind of long-range shell behavioral values device and method of wooden horse |
| CN106408085A (en) * | 2016-08-31 | 2017-02-15 | 天津南大通用数据技术股份有限公司 | BP neural network classification method for solving nonlinear problem through single hidden layer |
| CN107247954A (en) * | 2017-06-16 | 2017-10-13 | 山东省计算中心（国家超级计算济南中心） | A kind of image outlier detection method based on deep neural network |
| CN109063777B (en) * | 2018-08-07 | 2019-12-03 | 北京邮电大学 | Net flow assorted method, apparatus and realization device |
| CN109063777A (en) * | 2018-08-07 | 2018-12-21 | 北京邮电大学 | Net flow assorted method, apparatus and realization device |
| CN109858246A (en) * | 2018-12-24 | 2019-06-07 | 福州大学 | A kind of classification method for control signal type hardware Trojan horse |
| CN109858246B (en) * | 2018-12-24 | 2022-06-14 | 福州大学 | Classification method for control signal type hardware trojans |
| CN109740348A (en) * | 2019-01-29 | 2019-05-10 | 福州大学 | A kind of hardware Trojan horse localization method based on machine learning |
| CN109740348B (en) * | 2019-01-29 | 2022-06-14 | 福州大学 | Hardware Trojan horse positioning method based on machine learning |
| CN110990835A (en) * | 2019-11-22 | 2020-04-10 | 南京邮电大学 | Neural network Trojan horse detection method based on sample judgment error |
| CN110990835B (en) * | 2019-11-22 | 2022-10-14 | 南京邮电大学 | Neural network Trojan horse detection method based on sample judgment error |
| CN111324889A (en) * | 2020-03-04 | 2020-06-23 | 深信服科技股份有限公司 | Security event prediction method, device, equipment and computer readable storage medium |
| CN111865999A (en) * | 2020-07-24 | 2020-10-30 | 中国工商银行股份有限公司 | Access behavior recognition method and device, computing equipment and medium |
| US11394742B2 (en) | 2020-08-17 | 2022-07-19 | International Business Machines Corporation | Detecting trojan neural networks |
| CN113568068A (en) * | 2021-07-22 | 2021-10-29 | 河南大学 | Strong convection weather prediction method based on MPI parallel three-dimensional neural network |
| CN113568068B (en) * | 2021-07-22 | 2022-03-29 | 河南大学 | Strong convection weather prediction method based on MPI parallel three-dimensional neural network |
Also Published As
| Publication number | Publication date |
|---|---|
| CN102469103B (en) | 2013-03-06 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102469103B (en) | Trojan event prediction method based on BP (Back Propagation) neural network | |
| US20200192741A1 (en) | Automatic model-based computing environment performance monitoring | |
| JP5962190B2 (en) | Method and apparatus for predicting short-term power load | |
| CN103164742B (en) | A kind of server performance Forecasting Methodology based on particle group optimizing neural network | |
| CN102945310B (en) | Based on epidemic transmission network modelling and the deduction of autonomic computing | |
| CN105989441A (en) | Model parameter adjustment method and device | |
| Rathnasabapathy et al. | Exact solutions of interactive POMDPs using behavioral equivalence | |
| CN103197983A (en) | Service component reliability online time sequence predicting method based on probability graph model | |
| CN104035779A (en) | Method for handling missing values during data stream decision tree classification | |
| CN109523021A (en) | A kind of dynamic network Structure Prediction Methods based on long memory network in short-term | |
| CN102395135A (en) | VLR (Visitor Location Register) user number predicting method based on gray system model neural network | |
| WO2021180245A1 (en) | Server, data processing method and apparatus, and readable storage medium | |
| Zhang et al. | Traffic signal optimization for partially observable traffic system and low penetration rate of connected vehicles | |
| CN113470836A (en) | Infectious disease trend prediction method, system, device and storage medium | |
| CN109889391A (en) | A kind of network short term traffic forecasting method based on built-up pattern | |
| Gomez-Cravioto et al. | Data analysis and forecasting of the COVID-19 spread: A comparison of recurrent neural networks and time series models | |
| CN115051929B (en) | Network fault prediction method and device based on self-supervision target perception neural network | |
| CN110766201A (en) | Revenue prediction method, system, electronic device, computer-readable storage medium | |
| CN116028315A (en) | Operation early warning method, device, medium and electronic equipment | |
| CN111598328A (en) | Power load prediction method considering epidemic situation events | |
| CN110322693A (en) | A kind of traffic data complementing method, system, equipment and medium | |
| CN116956155A (en) | Sewage treatment intelligent dosing method and system based on artificial intelligence | |
| Zhou et al. | Application of hidden Markov models to analyze, group and visualize spatio-temporal COVID-19 data | |
| An et al. | A nonlinear model predictive control model aimed at the epidemic spread with quarantine strategy | |
| CN113326972B (en) | Bus lane short-time speed prediction method based on real-time bus speed statistical data |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20130306 Termination date: 20140701 |
|
| EXPY | Termination of patent right or utility model |